8820174c886cd517334df9b2b4395bc504a8fe471e7b60f920564a0405c2631a | Triage

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
28-08-2023 17:09

Sharing

Report Analysis Logs

General

Target

sample.exe
Size

210KB
MD5

aa53b49466385185d27209e5eb28ed7a
SHA1

e519ffb33c58760c40139039324f2c044ea85564
SHA256

8820174c886cd517334df9b2b4395bc504a8fe471e7b60f920564a0405c2631a
SHA512

c4b754037de2db565e85d369e27f8a809d79dfc84a154bf806bf3aa27d5144853e9edf245395a6f6e8e81a9fd0cbdcc2438cc4aefaaa0d3cd8648fa6665816f0
SSDEEP

3072:A8GYBy0NYz1IEb4Cq6DiHBSK+vM/+U9s/G/WGNa/J2e0adH0ZP4Fb19R7:ZByaYzlPiHoKf/+U2++h/Ey1RJj

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe
1076	sample.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1076	sample.exe

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-0-0x0000000000B60000-0x0000000000B95000-memory.dmp

Filesize
212KB

Download
memory/1076-1-0x0000000000B60000-0x0000000000B95000-memory.dmp

Filesize
212KB

Download
memory/1076-2-0x0000000000BA0000-0x0000000000EA3000-memory.dmp

Filesize
3.0MB

Download
memory/1076-3-0x0000000000B60000-0x0000000000B95000-memory.dmp

Filesize
212KB

Download